EUVD-2026-60475
GHSA-3p64-6gvh-82v5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requires only a valid authenticated session (PR:L); no confidentiality or availability impact, only dataset lineage metadata integrity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
AnalysisAI
Missing authorization enforcement on the log-inputs API endpoint in MLflow 3.13.0 through 3.14.x allows any authenticated user to inject fabricated DatasetInput records into another user's run lineage metadata without holding UPDATE permission on that run. The root cause is that the LogInputs (and LogOutputs) handler was simply never registered in the BEFORE_REQUEST_HANDLERS auth middleware map, leaving the POST /api/2.0/mlflow/runs/log-inputs endpoint unguarded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session on the target MLflow deployment (PR:L - low-privilege user account sufficient, no admin role needed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the real-world profile: the attack is network-accessible and low-complexity, but requires a valid authenticated session (PR:L), which meaningfully constrains the attacker pool to existing platform users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MLflow 3.15.0, which includes the fix from PR #24291 (commit 5c34aec5669e2386b38b5ee0855cd61174e27693) that registers LogInputs and LogOutputs in the BEFORE_REQUEST_HANDLERS map with validate_can_update_run enforcement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today